Currently customer has a common cloud gateway servers configured on Load balancer which will connect non-mTLS mode with several applications.
The requirement now is to enforce mTLS on a web service integration via Cloud Gateway. Can you please me to validate below questions with my answers.
1. Does mTLS only required to enabled in Cloud GW only? 2-way SSL Answer: As per my understadning 2-Way SSL is not mandatory, since the mTLS configuration is enforced for app connectivity configuring mTLS between Cloud GW and app should suffice
2. The option for “Enable client authentication” for Cloud gateway facing apps, the certifcate should be on IIQ or Cloud gateway Answer: the Certificate should be on Cloud gateway servers
3. By enabling mTLS at Cloud GW, does it require to enable mTLS between IIQ and Cloud Gateway Answer: Not required
4. Does enabling mTLs for only application, will it effect the other apps that are configured in non-mTLS mode Answer: Should not effect
Is mTLS required only on Cloud Gateway?
mTLS is required only on the Cloud Gateway ↔ application connection for this requirement. The IIQ ↔ Cloud Gateway connection can remain as is (plain TLS or HTTP) if acceptable by security policy.
Where should the client certificate be installed?
The client certificate used for mTLS must be installed on the Cloud Gateway servers, because Cloud Gateway is the TLS client when connecting to the backend application.
Do we need mTLS between IIQ and Cloud Gateway as well? No, not technically. Enabling mTLS between Cloud Gateway and the application does not require mTLS between IIQ and Cloud Gateway. That link can remain non-mTLS, although you may choose to secure it based on internal security requirements.
Will enabling mTLS for one application affect others still using non-mTLS? No, provided mTLS is configured per-application / per-route in Cloud Gateway. Only that specific application integration will use mTLS. Other applications configured for non-mTLS will continue to work as before, as long as you don’t apply a global “client certificate required” setting on the shared listener.